CVE catalog

CVE-2020-16845

Withdrawn Advisory: Infinite loop in xz

Go before 1.13.15 and 14.x before 1.14.7 can have an infinite read loop in ReadUvarint and ReadVarint in encoding/binary via invalid inputs.

Severity: High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published: Aug 6, 2020, 12:00:00 AM UTC
Updated: Aug 21, 2026, 3:22:17 AM UTC
Source: [NVD] · [CVE record]
EPSS: 4.86% · Oct 27, 2026

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
GoRelease not reported	github.com/ulikunitz/xz	`0.5.8`	Fixed	[GHSA-Q6GQ-997W-F55G]Aug 21, 2026, 3:22:17 AM UTC

Showing 1 fix observations. All 58 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
GoRelease not reported	github.com/ulikunitz/xz	`0.5.8`	Fixed	[GHSA-Q6GQ-997W-F55G]Aug 21, 2026, 3:22:17 AM UTC
Debian11	golang-1.15	`1.15~rc2-1`	UnknownSource applicability is not established	[DEBIAN-CVE-2020-16845]Aug 27, 2026, 1:03:08 PM UTC
Opensuseleap 15.1	go1.13	`1.13.15-lp151.8.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2020:1178-1]May 7, 2025, 6:11:45 PM UTC
Opensuseleap 15.2	go1.13	`1.13.15-lp152.2.7.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2020:1194-1]Feb 4, 2026, 2:45:36 AM UTC
Ubuntu14.04	golang-1.10	`1.10.4-2ubuntu1~14.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.10	`1.10.4-2ubuntu1~16.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.10	`1.10.4-2ubuntu1~16.04.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.6	`1.6-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.6	`1.6-0ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.6	`1.6-0ubuntu3`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.6	`1.6-0ubuntu4`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.6	`1.6-0ubuntu5`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.6	`1.6.1-0ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.6	`1.6.2-0ubuntu5~16.04`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.6	`1.6.2-0ubuntu5~16.04.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.6	`1.6.2-0ubuntu5~16.04.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu16.04	golang-1.6	`1.6.2-0ubuntu5~16.04.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.10	`1.10-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.10	`1.10.1-1ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.10	`1.10.4-2ubuntu1~18.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.10	`1.10.4-2ubuntu1~18.04.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.10	`1.10~rc1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.10	`1.10~rc1-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.10	`1.10~rc1-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.10	`1.10~rc2-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.13	`1.13.8-1ubuntu1~18.04.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu18.04	golang-1.13	`1.13.8-1ubuntu1~18.04.3`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu18.04	golang-1.13	`1.13.8-1ubuntu1~18.04.4`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu18.04	golang-1.8	`1.8.3-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.8	`1.8.3-2ubuntu1.18.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.9	`1.9.1-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.9	`1.9.2-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.9	`1.9.2-3ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.9	`1.9.3-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu18.04	golang-1.9	`1.9.4-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu20.04	golang-1.13	`1.13.1-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu20.04	golang-1.13	`1.13.3-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu20.04	golang-1.13	`1.13.4-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu20.04	golang-1.13	`1.13.5-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu20.04	golang-1.13	`1.13.6-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu20.04	golang-1.13	`1.13.6-2ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu20.04	golang-1.13	`1.13.7-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu20.04	golang-1.13	`1.13.8-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu20.04	golang-1.13	`1.13.8-1ubuntu1.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu20.04	golang-1.14	`1.14-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu20.04	golang-1.14	`1.14.1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu20.04	golang-1.14	`1.14.2-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu20.04	golang-1.14	`1.14.2-1ubuntu1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu20.04	golang-1.14	`1.14.3-2ubuntu2~20.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu20.04	golang-1.14	`1.14.3-2ubuntu2~20.04.2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu20.04	golang-1.14	`1.14~beta1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu20.04	golang-1.14	`1.14~beta1-2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu20.04	golang-1.14	`1.14~rc1-1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntu22.04	golang-1.13	`1.13.8-1ubuntu2`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntu22.04	golang-1.13	`1.13.8-1ubuntu2.22.04.1`	UnknownSource applicability is not established	[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC[USN-5725-1]Apr 27, 2026, 4:24:33 PM UTC
Ubuntupro	golang-1.13	`1.13.8-1ubuntu1~16.04.2`	UnknownSource applicability is not established	[USN-5725-2]Jun 25, 2026, 1:31:33 PM UTC[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntupro	golang-1.13	`1.13.8-1ubuntu1~16.04.3`	UnknownSource applicability is not established	[USN-5725-2]Jun 25, 2026, 1:31:33 PM UTC[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC
Ubuntupro	golang-1.13	`1.13.8-1ubuntu1~16.04.3+esm2`	UnknownSource applicability is not established	[USN-5725-2]Jun 25, 2026, 1:31:33 PM UTC[UBUNTU-CVE-2020-16845]May 20, 2026, 4:04:14 PM UTC

Original provider fields

{
  "package_releases": [],
  "fixed_versions": [],
  "distribution_packages": [
    {
      "name": "github.com/ulikunitz/xz",
      "ecosystem": "go",
      "provider_url": "https://github.com/advisories/GHSA-q6gq-997w-f55g",
      "fixed_version": "0.5.8",
      "provider_source": "github",
      "provider_record_id": "GHSA-Q6GQ-997W-F55G",
      "provider_updated_at": "2026-08-21T03:22:17Z"
    },
    {
      "name": "golang-1.15",
      "distro": "debian",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.15~rc2-1"
            }
          ]
        }
      ],
      "release": "11",
      "versions": [],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/DEBIAN-CVE-2020-16845",
      "fixed_version": "1.15~rc2-1",
      "provider_source": "pypi",
      "provider_record_id": "DEBIAN-CVE-2020-16845",
      "provider_updated_at": "2026-08-27T13:03:08.032264382Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.13",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.8-1ubuntu1~16.04.3+esm2"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.13.8-1ubuntu1~16.04.2",
        "1.13.8-1ubuntu1~16.04.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5725-2",
      "fixed_version": "1.13.8-1ubuntu1~16.04.3+esm2",
      "provider_source": "pypi",
      "provider_record_id": "USN-5725-2",
      "provider_updated_at": "2026-06-25T13:31:33.113521577Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.10",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "14.04",
      "versions": [
        "1.10.4-2ubuntu1~14.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.13",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.8-1ubuntu1~16.04.3+esm2"
            }
          ]
        }
      ],
      "release": "pro",
      "versions": [
        "1.13.8-1ubuntu1~16.04.2",
        "1.13.8-1ubuntu1~16.04.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "1.13.8-1ubuntu1~16.04.3+esm2",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.10",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "1.10.4-2ubuntu1~16.04.1",
        "1.10.4-2ubuntu1~16.04.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.6",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "16.04",
      "versions": [
        "1.6-0ubuntu1",
        "1.6-0ubuntu2",
        "1.6-0ubuntu3",
        "1.6-0ubuntu4",
        "1.6-0ubuntu5",
        "1.6.1-0ubuntu1",
        "1.6.2-0ubuntu5~16.04",
        "1.6.2-0ubuntu5~16.04.2",
        "1.6.2-0ubuntu5~16.04.3",
        "1.6.2-0ubuntu5~16.04.4"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.13",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.8-1ubuntu1~18.04.4"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.13.8-1ubuntu1~18.04.2",
        "1.13.8-1ubuntu1~18.04.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "1.13.8-1ubuntu1~18.04.4",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.10",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.10~rc1-1",
        "1.10~rc1-1ubuntu1",
        "1.10~rc1-2ubuntu1",
        "1.10~rc2-1ubuntu1",
        "1.10-1ubuntu1",
        "1.10.1-1ubuntu2",
        "1.10.4-2ubuntu1~18.04.1",
        "1.10.4-2ubuntu1~18.04.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.8",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.8.3-2ubuntu1",
        "1.8.3-2ubuntu1.18.04.1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.9",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.9.1-2ubuntu1",
        "1.9.2-1ubuntu1",
        "1.9.2-3ubuntu1",
        "1.9.3-1ubuntu1",
        "1.9.4-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.13",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.8-1ubuntu1.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.13.1-1ubuntu1",
        "1.13.3-1ubuntu1",
        "1.13.4-1ubuntu1",
        "1.13.5-1ubuntu1",
        "1.13.6-1ubuntu1",
        "1.13.6-2ubuntu1",
        "1.13.7-1ubuntu1",
        "1.13.8-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "1.13.8-1ubuntu1.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.14",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.14~beta1-1",
        "1.14~beta1-2",
        "1.14~rc1-1",
        "1.14-1",
        "1.14.1-1",
        "1.14.2-1",
        "1.14.2-1ubuntu1",
        "1.14.3-2ubuntu2~20.04.1",
        "1.14.3-2ubuntu2~20.04.2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.13",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.8-1ubuntu2.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1.13.8-1ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/UBUNTU-CVE-2020-16845",
      "fixed_version": "1.13.8-1ubuntu2.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "UBUNTU-CVE-2020-16845",
      "provider_updated_at": "2026-05-20T16:04:14.454421404Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.13",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.8-1ubuntu1~18.04.4"
            }
          ]
        }
      ],
      "release": "18.04",
      "versions": [
        "1.13.8-1ubuntu1~18.04.2",
        "1.13.8-1ubuntu1~18.04.3"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5725-1",
      "fixed_version": "1.13.8-1ubuntu1~18.04.4",
      "provider_source": "pypi",
      "provider_record_id": "USN-5725-1",
      "provider_updated_at": "2026-04-27T16:24:33.725519Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.13",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.8-1ubuntu1.1"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "1.13.1-1ubuntu1",
        "1.13.3-1ubuntu1",
        "1.13.4-1ubuntu1",
        "1.13.5-1ubuntu1",
        "1.13.6-1ubuntu1",
        "1.13.6-2ubuntu1",
        "1.13.7-1ubuntu1",
        "1.13.8-1ubuntu1"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5725-1",
      "fixed_version": "1.13.8-1ubuntu1.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-5725-1",
      "provider_updated_at": "2026-04-27T16:24:33.725519Z",
      "applicability_unknown": true
    },
    {
      "name": "golang-1.13",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.8-1ubuntu2.22.04.1"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "1.13.8-1ubuntu2"
      ],
      "ecosystem": "deb",
      "provider_url": "https://osv.dev/vulnerability/USN-5725-1",
      "fixed_version": "1.13.8-1ubuntu2.22.04.1",
      "provider_source": "pypi",
      "provider_record_id": "USN-5725-1",
      "provider_updated_at": "2026-04-27T16:24:33.725519Z",
      "applicability_unknown": true
    },
    {
      "name": "go1.13",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.15-lp152.2.7.1"
            }
          ]
        }
      ],
      "release": "leap 15.2",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:1194-1",
      "fixed_version": "1.13.15-lp152.2.7.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2020:1194-1",
      "provider_updated_at": "2026-02-04T02:45:36.200705Z",
      "applicability_unknown": true
    },
    {
      "name": "go1.13",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.13.15-lp151.8.1"
            }
          ]
        }
      ],
      "release": "leap 15.1",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2020:1178-1",
      "fixed_version": "1.13.15-lp151.8.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2020:1178-1",
      "provider_updated_at": "2025-05-07T18:11:45.173175Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

Observed: Oct 23, 2026, 5:48:49 PM UTC

References

[CERT-Bund public advisories] · [FIRST EPSS] · [GitHub Advisory Database] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]